pr-status-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request metadata, including titles, labels, and review comments.
- Ingestion points: Data enters the agent's context through
gh search prs,gh pr view, andgh api graphqlcommands. - Boundary markers: The instructions require presenting the data in a Markdown table, which helps organize information for the user but does not provide a security boundary to prevent the agent from processing malicious instructions hidden within PR fields.
- Capability inventory: The skill uses the
ghtool to interact with repositories. While the skill's logic is read-oriented, the agent likely has broader permissions that could be targeted via indirect instructions found in PR content. - Sanitization: There is no instruction to escape, filter, or sanitize the content retrieved from GitHub before it is summarized by the agent.
Audit Metadata